CVSS: 5.9EPSS: 20%CPEs: 34EXPL: 0CVE-2017-3738 – openssl: rsaz_1024_mul_avx2 overflow bug on x86_64
https://notcve.org/view.php?id=CVE-2017-3738
07 Dec 2017 — There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH1024 are considered just feasible, because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be sign... • http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html • CWE-190: Integer Overflow or Wraparound CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 1%CPEs: 23EXPL: 0CVE-2017-14919
https://notcve.org/view.php?id=CVE-2017-14919
30 Oct 2017 — Node.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a denial of service (uncaught exception and crash) by leveraging a change in the zlib module 1.2.9 making 8 an invalid value for the windowBits parameter. Node.js en versiones anteriores a la 4.8.5, las versiones 6.x anteriores a la 6.11.5 y las versiones 8.x anteriores a la 8.8.0 permiten que atacantes remotos provoquen una denegación de servicio (excepción no detectada y cierre inesperado) aprovechando un cambio... • http://www.securityfocus.com/bid/101881 • CWE-20: Improper Input Validation •